CVE-2021-1782
A race condition was addressed with improved locking.
- Severity
- 7.0 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 2.22%
- Chance of exploitation in the next 30 days. Higher than 82.69% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Nov 3, 2021
- Fix
- None yet
- No fixed version published
Description
A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited..
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 7.0
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-667: Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
How to prevent it
- Implementation: Use industry standard APIs to implement locking mechanism.
CWE-667: Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
How to prevent it
- Implementation: Use industry standard APIs to implement locking mechanism.
References
Advisories
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-567q-5qvw-pf92 filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break | Low | Same weakness, CWE-667 |
| GHSA-6hcq-hmm3-jj3c Spring MVC and WebFlux has Server Sent Event stream corruption | Low | Same weakness, CWE-667 |
| CVE-2025-43510 A memory corruption issue was addressed with improved lock state checking. | High Known exploited | Same weakness, CWE-667 |
| GHSA-m2v9-w374-5hj9 vyper default functions don't respect nonreentrancy keys | Medium | Same weakness, CWE-667 |
| GHSA-3hg2-r75x-g69m Vyper has incorrect re-entrancy lock when key is empty string | Medium | Same weakness, CWE-667 |
| GHSA-vr8j-hgmm-jh9r Denial of service by double-checked locking in openssl-src | High | Same weakness, CWE-667 |
| GO-2022-0830 Denial of Service in Gitea | High | Same weakness, CWE-667 |
| GHSA-h67m-xg8f-fxcf Deadlock in mutually recursive `tf.function` objects | Medium | Same weakness, CWE-667 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor